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DETAILED ACTION 

1 . This action is in response to the Amendment filed July 12, 2005. 

2. Claims 1-4, 8, 24, 25, 33, 35, 36, 39, 43, 90, 91, and 94-97 have been amended. 

3. Claims 1-97 have been examined and are pending with this action. 



Claim Objections 

4. Claims 94 and 97 is objected to under 37 CFR 1 .75(c), as being of improper 
dependent form for failing to further limit the subject matter of a previous claim. 
Applicant is required to cancel the claim(s), or amend the claim(s) to place the claim(s) 
in proper dependent form, or rewrite the claim(s) in independent form. Claim 94 
reiterates what has been already claimed in claim 39 and claim 97 reiterates what has 
been already claimed in claim 43. 



t 
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Claim Rejections - 35 USC § 1 12 

5. Rejections of claims 2 3, 8, 24, 25, 35, 36, 90, and 91 under 35 U.S.C. 1 12, 
second paragraph has been withdrawn. 



Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

6. Claims 1-3, 8-13, 15-17, 24-36, 39-49, 54-59, 61-63, 70-82, 85-92, and 94-97 are 
rejected under 35 U.S.C. 102(b) as being anticipated by Post (US 5,822,527 A). 
INDEPENDENT: 

As per claim 1, Post teaches a method for monitoring a distributed computing 
system that in operation includes a data stream passing messages to or from an 
application in the system, the method comprising: 

monitoring message passing on the data stream, including monitoring a first 
message on the data stream (see Fig.1 and col.6, lines 26-29); evaluating, using data 
from the first message, a current set of one or more rules producing a current set of 
evaluated rules (see col .2, lines 27-34 & 54-64 and col.7, lines 30-35); and recording 
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data associated with the first message in accordance with the current set of evaluated 
rules (see col.2, lines 34-36 & 65-67 and col.3, lines 63-67). 

As per claim 39, Post teaches a system for filtering data comprising: 
at least one application providing a service (see col. 8, lines 56-65); 
at least one application server and stream sensor associated with each of said at 
least one application, said stream sensor filtering a data stream of said at least one 
application in accordance with a dynamically evaluated (see col.6, lines 10-25) current 
set of rules producing filtered data, said current set of rules being dynamically evaluated 
for received message (see Fig.1 ; Fig.3; col.2, lines 28-36 & 59-67; and col.4, line 57- 
col.5, line 5); and 

a context engine associated with each of said at least one application, said 
context engine including an aggregation service that aggregates said filtered data for 
said application (see Fig.3, steps 320-326; col.7, lines 65-67; and col.9, lines 44-47) in 
accordance with at least one local aggregation condition (see col.9, lines 18-30). 

As per claims 43, 85, 95, and 97, Post teaches a method for capturing data from 
a data stream of an application comprising: 

receiving a first message from said data stream of said application (see Fig.1 , 

#102); 

storing first context information represents including a copy of a first set of one or 
more rules, said first context information describing a processing state of said first 
message used during a first processing lifetime of said first message, said first set of 
one or more rules used in obtaining first data related to said first message, said first set 
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of one or more rules being identified as a current set of rules (see col .3, line 53-65 and 
col .4, lines 11-25); 

defining a second set of one or more rules at runtime of said application while 
said application is servicing a request such that any subsequently received messages 
are processed in accordance with said second set of one or more rules, said second set 
of one or more rules replacing said first set of one or more rules as the current set of 
rules (see Fig.3, steps 314-320); 

receiving a second message from said data stream (see Fig. 1, #104) during said 
first processing lifetime of said first message (see col.1 , lines 21-24); and 

storing second context information represents including a copy of said second 
set of one or more rules, said second context information describing a processing state 
of said second message used during a second processing lifetime of said second 
message, said second set of rules used in obtaining second data related to said second 
message (see col .3, line 53-65 and col.4, lines 1 1-25), said first processing lifetime and 
said second processing lifetime overlapping for at least a portion of both lifetimes such 
that said first and second messages are concurrently processed (see col.1 , lines 21-24). 

As per claim 47, Post teaches a computer program product for filtering data from 
a data stream of a web services application comprising: 

executable code that receives a message (see Fig.1 and col. 6, lines 26-29); 

executable code that evaluates, using data from the message, a current set of 
one or more rules producing a current set of evaluated rules (see col.2, lines 27-34 & 
54-64 and col.7, lines 30-35); and 
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executable code that collects data associated with the message in accordance 
with the current set of evaluated rules (see col.2, lines 34-36 & 65-67 and col.3, lines 
63-67). 

DEPENDENT: 

As per claim 2, Post teaches wherein said evaluating and said recording are 
performed while said distributed computing system is servicing request (see col.3, lines 
63-65). 

As per claims 3 and 92, Post teaches of further comprising: specifying a first set 
of rules; and specifying a second set of rules while said distributed computing system 
services requests and filters data from said distributed computing system's data stream, 
said second set of rules replacing said first set of rules as said current set of rules (see 
Fig.3, steps 314-320 and steps 314-326 and col.7, line 65-col.8, linel), wherein the 
specifying of the second set of rules is performed in real time (see claim 90 rejection 
above). 

As per claims 8 and 54, Post further teaches wherein each rule in said first set 
of rules has a condition portion and an associated action portion, and the method further 
comprising: extracting one or more data items using said first message (see col.2, lines 
28-30 & 59-60 and col.8, lines 13-18); evaluating each condition portion in accordance 
with said one or more data items (see col.2, lines 30-34 & 60-64 and col.7, lines 8-12); 
and for each condition portion evaluating to true, performing said associated action 
portion (see Fig.3, steps 320-324 and col.2, lines 34-36 & 64-67). 
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As per claims 9 and 55, Post further teaches wherein said one or more data 
items include at least one of: message origin information (see col. 3, lines 58-62), 
message header information, web service methods, message parameter, message 
metadata, and authentication and authorization data. 

As per claims 10 and 56, Post further teaches wherein said associated action 
portion includes performing at least one of: outputting data, executing an application, 
and sending a message (see col.4, lines 57-61). 

As per claims 11 and 57, Post further teaches wherein said associated action 
portion includes executing an application and said application is one of: a customized 
application and an e-mail application (see col.1, line 15 and col.3, line 46). 

As per claims 12 and 58, Post further teaches wherein said associated action 
portion includes sending a message and said message sent is one of: an e-mail 
message, and a message in accordance with a predefined protocol (implicit: see col.1, 
line 15; col.3, line 46; and Col.4, lines 3-6). 

As per claims 13 and 59, further teaches wherein said associated action portion 
includes performing at least one of: rejecting a request, and transferring control to an 
application in accordance with at least one compliance condition (see col .7, lines 51-53; 
col.9, lines 12-32; and col. 12, line 9). 

As per claims 15 and 61 1 Post further teaches wherein said associated action 
portion includes outputting data to at least one of: an event log, a system log, an error 
log, and a file included in a file system (see col .5, lines 48-51). 
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As per claims 16 and 62, teaches of further comprising: synchronizing access to 
a commonly accessed resource in accordance with said associated action portion (see 
col.9, lines 12-32). 

As per claims 17 and 63, Post teaches of further comprising: concurrently 
accessing a commonly accessed resource in accordance with said associated action 
portion (see col.1 , lines 21-22). 

As per claims 24 and 89, Post further teaches wherein said application includes 
a web services application (see col.1 , line 15 and col. 3, line 46: "electronic mail") and 
the data stream is associated with the web service application (inherent). 

As per claims 25 and 71, Post further teaches wherein said web services 
application is associated with an application server and a stream sensor, said stream 
sensor performing said evaluating (see col.8, lines 1-5). 

As per claims 26 and 72, Post teaches of further comprising: using a console to 
specify said current set of rules (see col. 6, lines 36-40). 

As per claims 27 and 73, Post teaches of further comprising: using a non- 
interactive input source to specify said current set of rules (see col .6, lines 40-43). 

As per claims 28 and 74, Post teaches of further comprising: selecting at least 
one condition (see col. 7, lines 51-53) and at least one data item included in said current 
set of rules (see col. 7, lines 1 3-18). 

As per claims 29 and 75, Post further teaches wherein said evaluating each 
condition portion further comprises: performing expression processing in accordance 
with said one or more data items (see col.1 0, lines 17-22). 
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As per claims 30 and 76, Post teaches of further comprising: performing format 
processing in connection with outputting data for an action portion of a rule when a 
condition portion of said rule evaluates to true (see col. 9, lines 59-62). 

As per claims 31 and 77, Post further teaches wherein each rule of said current 
set of one or more rules includes a condition portion (see col .7, lines 51-53) and an 
action portion, said action portion being performed if said condition portion evaluates to 
true (see col. 7, lines 51-65). 

As per claims 32 and 78, Post further teaches wherein said condition portion 
includes a reference to a user-defined routine (see col. 5, lines 34-40). 

As per claims 33 and 79, Post further teaches wherein said action portion 
includes outputting data to an output destination, and the method further comprising: 
outputting first data to a first output destination executing a first routine in accordance 
with a first condition; and outputting second data to a second output destination 
executing a second routine in accordance with a second condition, said first output 
destination being different from said second output destinations (see col.3, lines 53-65). 

As per claims 34 and 80, Post further teaches wherein said first routine outputs 
first data to a third routine which aggregates said first data and outputs aggregated first 
data at predetermined time intervals to a third output destination different from said first 
and second output destinations (subjective: see col.9, lines 33-47). 

As per claim 35, Post further teaches wherein said first message is one of: an 
input message and an output message of said data stream of said distributed 
computing system (see col .4, lines 7-10 and col. 13, lines 28-30). 
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As per claim 36, Post further teaches wherein said messages monitored on the 
data stream include at least one input message and at least one output message of said 
data stream (see claims 35 rejection above). 

As per claim 40, Post further teaches wherein said filtered data is stored in raw 
data files used as input to said aggregation service which output summary data (see 
col. 1, lines 31-43). 

As per claim 41, Post further teaches wherein the system includes at least one 
application and a global aggregator gathering output summary data from each 
aggregation service associated with each of said at least one application (see col. 9, 
lines 12-17). 

As per claim 42, Post further teaches wherein said local aggregation condition is 
aggregating data locally for each transaction (inherent: see Fig.3). 

As per claims 44 and 86, Post teaches of further comprising: gathering data in 
accordance with said first message and said first set of one or more rules; and 
gathering data in accordance with said second message and said second set of one or 
more rules (see Fig.1 and col. 3, lines 53-65). 

As per claims 45 and 87, Post teaches of further comprising: determining, after 
processing said first message, whether a first data storage area storing said first context 
information can be reused by determining whether a set of rules included in said first 
data storage area is said current set of rules; determining, after processing said second 
message, whether a second data storage area storing said second context information 
can be reused by determining whether a set of rules included in said second data 
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storage area is said current set of rules; and designating said second data storage area 
for reuse and not designating said first data storage area for reuse (inherent: see col.4, 
lines 3-5). 

As per claims 46 and 88, Post teaches of further comprising: receiving a third 
message; determining whether there are any available data storage areas designated 
for reuse; and selecting one of said available data storage areas if there are any 
available and otherwise allocating additional storage for storing third context information 
for said third message, said third context information including a copy of said current set 
of rules (subjective: see col. 9, lines 33-47). 

As per claim 48, Post teaches wherein said executable code that evaluates and 
collects are performed in real-time while said web services application is servicing 
requests (see col .2, lines 37-49: "streams"). 

As per claim 49, Post teaches of further comprising: executable code that 
specifies a first set of rules; and executable code that specifies a second set of rules in 
real-time while said web services application services requests and filters data from said 
web services application's data stream, said second set of rules replacing said first set 
of rules as said current set of rules (see Fig.3, steps 314-320 and steps 314-326). 

As per claim 70, Post further teaches wherein said web services application is 
one of a plurality of applications providing web services (inherent: see col.2, lines 3-4). 

As per claim and 81, Post further teaches wherein said message received is one 
of: an input message and an output message of said data stream of said web services 
application (see col.4, lines 7-10 and col. 13, lines 28-30). 
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As per claim and 82, Post further teaches wherein a plurality of messages (see 
Fig.1) are received and said plurality of messages include at least one input message 
and at least one output message of said data stream of said web services application 
(see claim 81 rejection above). 

As per claims 90 and 91, Post teaches wherein said evaluating and said 
recording are performed in real-time (see col .2, lines 37-49: "streams") and performing, 
by said distributed computing system, a service in accordance with said message (see 
col.3, line 63-col.4, line 6). 

As per claim 94, Post further teaches wherein said current set of rules are 
dynamically evaluated for each received message (see col. 6, lines 10-25). 

As per claim 96, Post teaches of further comprising: setting a current set of rules 
to be the first set of rules; and replacing the first set of rules with the second set of rules 
as the current set of rules (see Fig.3, steps 314-320). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 4-7, 18-19, 50-53, 64-65, and 93 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Post (US 5,822,527 A) in view of Lui et al. (US 6,340,977 B1). 
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As per claims 4, 50, and 93, Post further teaches wherein said message is a first 
message and the method further comprising: a portion of a processing lifetime of said 
first message overlapping at least a portion of a processing lifetime of said second 
message (see col.1 , lines 21-24), each of said processing lifetimes being a time period 
during which an associated message is processed to gather data (implicit: see col. 8, 
lines 13-18). Post does not explicitly teach associating a first session structure with said 
first message from said data stream, said first session structure including a 
representation of said first set of rules (implicit: see col .3, lines 53-65); and associating 
a second session structure with a second message from said data stream, said second 
session structure including a representation of said second set of rules (implicit: see 
col. 3, lines 53-65). Lui teaches associating a first session structure with said first 
message from said data stream and associating a second session structure with a 
second message from said data stream (see col .40, lines 1 1 -1 6). It would have been 
obvious to a person of ordinary skill in the art at the time the invention was made to 
employ the teachings of Lui within the system of Post by implementing associating 
session structure with coinciding messages within the data filtering distributed 
computing system because Lui teaches that sessions are established to determine 
usage patterns for a particular user so that procedures can be automatically built and 
later used thereby making the application program more efficient (see col.7, lines 62- 
col.8, line 12) and further adds that such implementation allows for data structures to be 
organized by "containing all link and connective information such that traversal actions, 
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symbolic representations, and other operations can be processed or generated" (see 
col.40, lines 7-15). 

As per claims 5 and 51, Post and Lui further teach wherein processing of said 
first message is complete and the method further comprising: determining if said first set 
of rules included in said first session structure (see claim 4 rejection above) is a current 
set of rules (see Fig.3, steps 314-320); and designating said first session structure (see 
claim 4 rejection above) for reuse in processing another incoming message if said first 
set of rules is said current set of rules (inherent: see col .4, lines 3-5). 

As per claims 6 and 52, Post and Lui teaches further comprising: receiving said 
second message; determining whether there are any existing session structures (see 
claim 4 rejection above) designated for reuse; and selecting one of said existing session 
structures if there are any available for reuse (inherent: see col.4, lines 3-5), otherwise 
creating a new instance of a session structure for use in processing said second 
message (see col .5, line 65-col.6, line 16). 

As per claims 7 and 53, Post and Lui teaches of further comprising: using said 
current set of rules when creating a new instance of a session structure (subjective: see 
col.4, lines 3-5). 

As per claims 18 and 64, Post and Lui further teaches wherein processing a 
received message only synchronizes with processing of another received message 
when accessing a structure that includes one or more session objects for reuse and in 
connection with a globally accessed resource (see col. 9, lines 12-32). 
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As per claims 19 and 65, Post further teaches wherein said globally accessed 
resource is a resource requiring serial access (see col.1, lines 21-24). 

8. Claims 14 and 60 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Post (US 5,822,527 A) in view of Win et al. (US 6,161,139 A). Post teaches all the 
limitations of claims 14 and 60 except wherein said at least one compliance condition 
includes a predetermined number of unauthorized accesses. Win teaches of a 
condition including a predetermined number of unauthorized accesses (see col. 10, lines 
12-18). It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to employ the teachings of Win within the system of Post by 
implementing a predetermined number of unauthorized accesses condition within the 
data filtering distributed computing system because the condition(s) for filtering is 
subjective and does not patentably distinguish the claimed invention. 

9. Claims 37, 38, 83, and 84 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Post (US 5,822,527 A) in view of Todd et al. (US 6,742,059 B1). 
Post teaches all the limitations of claims 37, 38, 83, and 84 except wherein said event 
log is a Windows event log and wherein said system log is a UNIX syslog. Todd 
teaches wherein said event log is a Windows event log and wherein said system log is a 
UNIX syslog (see col. 2, lines 31-35). It would have been obvious to a person of 
ordinary skill in the art at the time the invention was made to employ the teachings of 
Todd within the system of Post by implementing Windows event log and Unix syslog 
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within the data filtering distributed computing system because Todd teaches that such 
logging is "critical for systems administrator software which may be experiencing 
problems on a server and which needs to correlate" problems to peripherals (see col. 2, 
lines 35-38). Therefore, such logging is vital in determining problems and/or issues of 
the filtering device and addressing these problems and/or issues to the administrator. 



Allowable Subject Matter 
10. Claims 20 and 66 are objected to as being dependent upon a rejected base 
claim, but would be allowable if rewritten in independent form including all of the 
limitations of the base claim and any intervening claims. 

The following is an examiner's statement of reasons for allowance: 
Prior art of record Post (US 5,822,527 A), Lui et al. (US 6,340,977 B1), Win et al. 
(US 6,161,139 A), and Todd et al. (US 6,742,059 B1), do not disclose, teach, or suggest 
of further comprising: receiving said first set of rules in one or more messages; parsing 
said first set of rules producing a representation; traversing said representation to 

construct one or more temporary definitions of objects in accordance with said first set 

< 

of rules; attempting to instantiate one or more objects in accordance with said one or 
more temporary definitions; determining whether an error has occurred in connection 
with said attempting to instantiate; and if no error has occurred in connection with said 
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attempting to instantiate, defining said first set of rules as said current set of rules as 
recited in claims 20 and 66. 

Claims 21-23 and 67-69 are objected to as being dependent upon objected 
allowable claims 20 and 66, respectively. 



Response to Arguments 

11. In response to applicant's argument of claim 1 , the recitation "passing on a data 
stream" has not been given patentable weight because the recitation occurs in the 
preamble. A preamble is generally not accorded any patentable weight where it merely 
recites the purpose of a process or the intended use of a structure, and where the body 
of the claim does not depend on the preamble for completeness but, instead, the 
process steps or structural limitations are able to stand alone. See In re Hirao, 535 
F.2d 67, 190 USPQ 15 (CCPA 1976) and Kropa v. Robie, 187 F.2d 150, 152, 88 
USPQ478, 481 (CCPA 1951). 

In response to the argument of claim 3, clearly Post teaches of a plurality of 
rules. In reference to Fig.3, step 314, Post teaches in col.7, line 65 to col.8, linel, that a 
determination is made whether more rules remain. Furthermore, Post teaches plurality 
of rule sets can be written for each stream (see col. 9, lines 44-47). 

In response to the argument of claim 39, again as taught by Post the recited 
reference location clearly suggests "aggregating said filtered data for said application". 
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t 

Post further teaches of plurality of modules "linked" together to monitor and apply rules 
sets. Therefore it is clearly implicit that when a module at a local location (see col .9, 
line 27-30: TAN') would apply the aggregate conditions as taught above according to 
local conditions. 

In response to the argument regarding claims 43 and 89, Post clearly teaches 
and suggests multiple rule sets (see above) and of "concurrently processed" messages 
(see Fig.3). 

In response to applicant's argument of claim 47, the recitation "filtering data from 
a data stream of a web service application" has not been given patentable weight 
because the recitation occurs in the preamble. A preamble is generally not accorded 
any patentable weight where it merely recites the purpose of a process or the intended 
use of a structure, and where the body of the claim does not depend on the preamble 
for completeness but, instead, the process steps or structural limitations are able to 
stand alone. See In re Hirao, 535 F.2d 67, 190 USPQ 15 (CCPA 1976) and Kropa v. 
Robie, 187 F.2d 150, 152, 88 USPQ 478, 481 (CCPA 1951). Furthermore clearly Post 
teaches of filtering data from a data stream (see col.2, lines 10-16). 



Conclusion 

12. For the reasons above, claims 1-19,24-65 and 70-97 remain rejected and claims 
20-23,66-69,94 and 97 remain objected. 
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1 3. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 

§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

14. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael Y. Won whose telephone number is 571-272- 
3993. The examiner can normally be reached on M-Th: 7AM-5PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Saleh Najjar can be reached on 571-272-4006. The fax phone number for 
the organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Michael Won 




